21d01722dffd6a6052e92e89ea2f78a815e9f38d36126e18afca71457f65bd4f

Analysis

max time kernel
14s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31/03/2023, 15:05

Target

Fraps/data/Lib/Lib2.dll
Size

208KB
MD5

9eefb97a2fd4bc1d3c43db1c86033b00
SHA1

ca03c90a99fca4360213869f1d1d06075bcba44a
SHA256

9e17951c529144886b1b7c36df7885033258528c795ab2b606e95d364c519f3d
SHA512

900977b8be48dbd2ec233a4b9a9e73598a2744c4e6bf95c7e64a61c0888390cf8b74310c025f3398d2666c867d44c353df50a81d0b403e8bd948cf547303fa4e
SSDEEP

3072:BVoWeMW1/5U/yaRisXt48Lj7oW8SA1AKl0Ckq0Dq88mIilWpoZ+3bbjko:z9IxWyapX3LjMWYCKl0CTeKmMM+J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib2.dll,#1
  2⤵
  PID:1680